Site backups cover the web root and the database. Mail sits somewhere else entirely, so it is quietly excluded - and years of correspondence is the one thing on a server that cannot be rebuilt from anything.

If the mailboxes are on your server

sudo rsync -aHAX --delete /var/vmail/ /srv/backup/vmail/
# then off-site
restic -r s3:s3.example.com/backups backup /srv/backup/vmail

Maildir stores one file per message, so this is incremental by nature: only new mail moves. Keep permissions with -aHAX or the mail server will not read what you restore.

If the mail is hosted elsewhere

You still need your own copy. A hosted mailbox is somebody else's disk and somebody else's retention policy, and a deleted-by-accident folder is often gone for good.

sudo apt-get install -y isync

# ~/.mbsyncrc
IMAPAccount work
Host mail.example.com
User sara@example.com
Pass "app-password"
SSLType IMAPS

mbsync -a          # pulls everything to local Maildir
offlineimap and imapsync do the same job. imapsync is the one to reach for when you are moving a mailbox between providers rather than keeping an archive.

Test a restore of one message

Copy one folder back into a test account and open it in a client. Maildir with the wrong ownership restores perfectly and shows an empty mailbox, which is a bad thing to learn on the day.

Mail archives contain more personal data than anything else you hold. Encrypt the backup and keep it under the same retention rules as the rest - see retention: how long is enough.